amaechler opened a new pull request, #20820:
URL: https://github.com/apache/druid/pull/20820
### Description
The `security vulnerabilities` job in `cron-job-its.yml` also runs on PRs
that change `owasp-dependency-check-suppressions.xml`. GitHub does not pass
secrets to workflows triggered by PRs from forks (for security purposes) and
`NVD_API_KEY` is empty there. dependency-check then fails before scanning
anything:
```
NvdApiException: Invalid API Key, length of 0 too short to provided a
masked partial key
NoDataException: No documents exist
```
I noticed this on #20790 (but also obsevable on #20615, #20689, #20731).
Runs from branches in `apache/druid`, such as #20236 and #20335, have the key
and get past the NVD download.
This skips the job for pull requests from forks, so they show the check as
skipped instead of failed. The nightly run on master and pull requests from
`apache/druid` branches still run it.
A skipped check does not mean the suppression change was scanned: for fork
pull requests, the next nightly run is the first real check.
<details>
<summary>Alternatives considered</summary>
- `pull_request_target` would expose the secrets to code from the fork,
since the job builds and runs the PR's Maven build. Not safe.
- Running without an API key: NVD rate-limits unauthenticated clients
heavily, and the database has over 400,000 records, so the download would take
hours. Not confirmed how long exactly.
- Caching the NVD data from the nightly run (and dropping
`dependency-check:purge`) would let fork pull requests scan without a key. That
is a larger change and overlaps other work on incremental dependency-check
updates, so it is left for a follow-up.
</details>
<hr>
This PR has:
- [x] been self-reviewed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
